linux-kernel - Re: [PATCH v2 2/2] LSM: Infrastructure management of the mnt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <200ce2d0-6243-415b-954c-3078779dff2c@schaufler-ca.com>
Date: Tue, 4 Nov 2025 09:46:07 -0800
From: Casey Schaufler <casey@...aufler-ca.com>
To: Paul Moore <paul@...l-moore.com>,
 Stephen Smalley <stephen.smalley.work@...il.com>
Cc: Ondrej Mosnacek <omosnace@...hat.com>, eparis@...hat.com,
 linux-security-module@...r.kernel.org, jmorris@...ei.org, serge@...lyn.com,
 keescook@...omium.org, john.johansen@...onical.com,
 penguin-kernel@...ove.sakura.ne.jp, linux-kernel@...r.kernel.org,
 selinux@...r.kernel.org, Casey Schaufler <casey@...aufler-ca.com>
Subject: Re: [PATCH v2 2/2] LSM: Infrastructure management of the mnt_opts
 security blob

On 10/13/2025 1:55 PM, Paul Moore wrote:
> On Thu, Oct 9, 2025 at 2:38 PM Stephen Smalley
> <stephen.smalley.work@...il.com> wrote:
>> On Thu, Sep 25, 2025 at 1:12 PM Casey Schaufler <casey@...aufler-ca.com> wrote:
>>> Move management of the mnt_opts->security blob out of the individual
>>> security modules and into the security infrastructure.  The modules
>>> tell the infrastructure how much space is required, and the space is
>>> allocated as required in the interfaces that use the blob.
>>>
>>> Signed-off-by: Casey Schaufler <casey@...aufler-ca.com>
>>> ---
>>> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
>>> index 4bba9d119713..1ccf880e4894 100644
>>> --- a/security/selinux/hooks.c
>>> +++ b/security/selinux/hooks.c
>>> @@ -656,19 +651,13 @@ static int selinux_set_mnt_opts(struct super_block *sb,
>>>         mutex_lock(&sbsec->lock);
>>>
>>>         if (!selinux_initialized()) {
>>> -               if (!opts) {
>>> -                       /* Defer initialization until selinux_complete_init,
>>> -                          after the initial policy is loaded and the security
>>> -                          server is ready to handle calls. */
>>> -                       if (kern_flags & SECURITY_LSM_NATIVE_LABELS) {
>>> -                               sbsec->flags |= SE_SBNATIVE;
>>> -                               *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
>>> -                       }
>>> -                       goto out;
>>> +               /* Defer initialization until selinux_complete_init,
>>> +                  after the initial policy is loaded and the security
>>> +                  server is ready to handle calls. */
>>> +               if (kern_flags & SECURITY_LSM_NATIVE_LABELS) {
>>> +                       sbsec->flags |= SE_SBNATIVE;
>>> +                       *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
>> This seemingly would produce a change in behavior for SELinux.

Except that it doesn't, at least from the tests I've been able to find.
If multiple LSMs use mount options you can't use the !opts test, because
there may be options for another LSM. Deferring initialization is harmless
when there are options, as it's all checked again later.

>> Previously we would only do this if there were no SELinux mount
>> options specified.
> What Stephen said.  I think this is good work that needs to be done
> (thank you for doing it!), but we have to preserve existing behaviors.
>